elastic / elastic/detection-rules
[New Rule] AWS security agent detection
- Dominant language
- Python
- Stars
- 2.7k
- Forks
- 696
- Avg merge
- 4d 17h
- Merged PRs (30d)
- 87
Description
### Description
Hello, I'd like to propose a detection that buils on this https://blog.richardfan.xyz/2026/03/14/pentesting-a-pentest-agent-heres-what-ive-found-in-aws-security-agent.html#can-i-protect-my-website-from-being-pentested-by-ai-agents
The detection as suggested in based on the user agent `securityagent` and it could target WAF logs but also webserver logs.
`user_agent.original : "*securityagent*"`
### Target Ruleset
None
### Target Rule Type
None
### Tested ECS Version
_No response_
### Query
_No response_
### New fields required in ECS/data sources for this rule?
_No response_
### Related issues or PRs
_No response_
### References
https://blog.richardfan.xyz/2026/03/14/pentesting-a-pentest-agent-heres-what-ive-found-in-aws-security-agent.html#can-i-protect-my-website-from-being-pentested-by-ai-agents
### Redacted Example Data
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.